Skip to content
Lxsmnsyc vulnerabilities
Newest
-
lxsmnsyc seroval
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
CVE-2026-116584
Fix available
7.5 High
-
lxsmnsyc seroval
Seroval: Code injection through a typed array's own constructor property
CVE-2026-116583
Fix available
5.3 Medium
-
lxsmnsyc seroval
Seroval: Script injection through RegExp sources in serialized output
CVE-2026-116582
Fix available
4.7 Medium
-
lxsmnsyc seroval
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116581
Fix available
7.5 High
-
lxsmnsyc seroval
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
CVE-2026-116580
Public exploitFix available
7.3 High
-
lxsmnsyc seroval
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
CVE-2026-104846
Fix available
9.8 Critical
-
lxsmnsyc seroval
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
CVE-2026-104845
Fix available
7.5 High
-
lxsmnsyc seroval
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
CVE-2026-59940
Fix available
9.8 Critical
-
lxsmnsyc seroval
Seroval affected by Denial of Service via Deeply Nested Objects
CVE-2026-24006
Fix available
7.5 High
-
lxsmnsyc seroval
seroval is vulnerable to Denial of Service via array serialization
CVE-2026-23957
Fix available
7.5 High
-
lxsmnsyc seroval
seroval affected by Denial of Service via RegExp serialization
CVE-2026-23956
Fix available
7.5 High
-
lxsmnsyc seroval
seroval Affected by Remote Code Execution via JSON Deserialization
CVE-2026-23737
Fix available
7.5 High
-
lxsmnsyc seroval
seroval Affected by Prototype Pollution via JSON Deserialization
CVE-2026-23736
Fix available
7.3 High